RADIUS Proxy Security Issues

It is not anticipated that a particular named user would be authenticated by multiple methods. This would make the user vulnerable to attacks that negotiate the least secure method from among a set. Instead, for each named user, there must be an indication of exactly one method used to authenticate that user name. If a user needs to make use of different authentication methods under different circumstances, distinct user names must be employed, each of which identifies exactly one authentication method. Passwords and other secrets must be stored at the respective ends, such that access to them is as limited as possible.

Ideally, the secrets must be accessible only to the process requiring access, in order to perform the authentication. The secrets must be distributed with a mechanism that limits the number of entities that handle (and gain knowledge of) the secret. Ideally, no unauthorized person must ever gain knowledge of the secrets.

© 1985-2000 Microsoft Corporation. All rights reserved.